UNITED STATES OF AMERICA Before the SECURITIES AND EXCHANGE COMMISSION SECURITIES EXCHANGE ACT OF 1934 Release No. 86421 / July 22, 2019 ADMINISTRATIVE PROCEEDING File No. 3-19260 In the Matter of Microsoft Corporation, Respondent. ORDER INSTITUTING CEASE-AND- DESIST PROCEEDINGS PURSUANT TO SECTION 21C OF THE SECURITIES EXCHANGE ACT OF 1934, MAKING FINDINGS, AND IMPOSING A CEASE- AND-DESIST ORDER I. The Securities and Exchange Commission (“Commission”) deems it appropriate that cease- and-desist proceedings be, and hereby are, instituted pursuant to Section 21C of the Securities Exchange Act of 1934 (“Exchange Act”), against Microsoft Corporation (“Microsoft” or “Respondent”). II. In anticipation of the institution of these proceedings, Respondent has submitted an Offer of Settlement (the “Offer”) which the Commission has determined to accept. Solely for the purpose of these proceedings and any other proceedings brought by or on behalf of the Commission, or to which the Commission is a party, and without admitting or denying the findings herein, except as to the Commission’s jurisdiction over it and the subject matter of these proceedings, which are admitted, Respondent consents to the entry of this Order Instituting Cease- And-Desist Proceedings Pursuant To Section 21C Of The Securities Exchange Act Of 1934, Making Findings, And Imposing A Cease-And-Desist Order (“Order”), as set forth below. III. On the basis of this Order and Respondent’s Offer, the Commission finds that: Summary 1. This matter concerns violations of the books and records and internal accounting controls provisions of the Foreign Corrupt Practices Act of 1977 (the “FCPA”) by Microsoft Corporation, a technology and software solutions provider, related to its operations in Hungary, Saudi Arabia, Thailand and Turkey. 2. As described below, from at least 2013 through 2015, Microsoft’s wholly-owned subsidiary in Hungary provided payments intended for foreign government officials in order to obtain business for Microsoft. The payments were made through third party vendors, consultants, distributors and resellers, including in circumstances where there was no evidence of any services provided by the third parties. Improper payments were also funded through excessive discounts that Microsoft’s senior executives in Hungary approved based on vague justifications without ensuring they were passed on to the end government customers. 3. In addition, in 2014 executives in Microsoft’s wholly-owned subsidiary in Turkey approved an excessive discount in a transaction involving an unauthorized third party in connection with a government tender in circumstances where there is no evidence of services provided by the third party. In addition, from 2012 through 2015 Microsoft’s wholly-owned subsidiaries in Saudi Arabia and Thailand provided improper travel and gifts and other things of value to both foreign government officials and employees of non-government customers, respectively, through slush funds maintained by their third party vendors and resellers. 4. Microsoft failed to make and keep adequate documentation related to third party vendors, consultants, distributors and resellers and failed to devise and maintain a sufficient system of internal accounting controls throughout the relevant time. Respondent 5. Microsoft is a Washington state corporation headquartered in Redmond, Washington. Microsoft develops, licenses and supports a wide range of software and services, among other things. Microsoft’s stock is registered with the Commission pursuant to Section 12(b) of the Exchange Act, and publicly-traded on the NASDAQ. Microsoft sells and markets its software and services worldwide through wholly-owned subsidiaries. The financial results of Microsoft’s wholly-owned subsidiaries are ultimately consolidated into Microsoft’s financial statements. Other Relevant Entities 6. Microsoft Magyarorszag Kft. (“MS Hungary”) is a direct, wholly-owned Microsoft subsidiary in Hungary. 7. Microsoft Ireland Operations Limited (“MIOL”) is an indirect, wholly-owned subsidiary of Microsoft with headquarters in Dublin, Ireland. Microsoft assigned to MIOL the right to license Microsoft software to customers in certain countries in Europe, the Middle East and Africa. 2 8. Microsoft Arabia (“MS Saudi Arabia”) is an indirect, wholly-owned Microsoft subsidiary in Saudi Arabia. 9. Microsoft Bilgisayar Yazilim Hizmetleri Limited Sirketi (“MS Turkey”) is an indirect, wholly-owned Microsoft subsidiary in Turkey. 10. Microsoft Thailand Ltd. (“MS Thailand”) is an indirect, wholly-owned Microsoft subsidiary based in Thailand. Facts Microsoft’s Sales Model 11. In many overseas markets, Microsoft sells its software licenses, in certain volume- licensing programs, through distributor and/or third party resellers called a Licensing Solution Partner (“LSP”). The LSPs are supposed to be authorized and approved by Microsoft. The third parties purchase the licenses and other products from Microsoft regional entities, such as MIOL, to sell to end customers, sometimes through additional third party vendors. 12. Microsoft does not directly enter into contracts with end customers. Instead, in certain foreign countries, a separate Microsoft subsidiary, MIOL, enters into framework licensing agreements with Microsoft’s government end customers. The framework licensing agreement sets forth the terms and conditions for Microsoft license purchases and usage by the government end customers. Typically, after a government end customer issues a tender, LSPs submit bids, and the winning bidder purchases the licenses from MIOL for resale to the end customer. The end customer and the LSP then sign a separate supply agreement reflecting, among other things, the final price and other terms agreed between the LSP and the end customer. 13. Microsoft maintains estimated retail prices for its software. Government and other large customers often expect to receive discounts from the estimated retail prices because of their size and negotiating power. To ensure consistent pricing with its LSPs in tenders, MIOL offers a standard discounted sale price to approved LSPs which reflected a built in margin. When bidding in a tender, LSPs can lower their price offered to end customers to be competitive. Microsoft also allows for additional discounts with its LSPs under certain circumstances and with certain approvals. Discounts above certain thresholds must be approved by Microsoft’s Business Desk, which had employees around the world. Microsoft expected that any additional approved discounts be passed on to the end customers. 14. In addition to licensing software, Microsoft also sells consulting and other services to help customers develop, deploy and manage its server and desktop solutions and provides training and certification on various Microsoft products. Microsoft’s subsidiaries routinely subcontract with third parties to provide these services. 3 15. Under Microsoft’s policies and procedures, Microsoft employees were required to record details of all sales transactions accurately, including prices, discounts and justification for any additional discount requests beyond the standard. For services transactions, Microsoft’s policies required that employees and subcontractors accurately record their time worked on a project in Microsoft’s internal timekeeping system. Hungary Licensing Transactions 16. Between 2014 and 2015, MS Hungary managers and employees obtained approval for discounts to LSPs on licensing transactions that were not passed on in full to Microsoft’s government customers in Hungary. To obtain approval for the discounts, MS Hungary employees provided false justifications to support the need for the discounts. Microsoft did not have sufficient procedures in place to determine whether the discount requests were legitimate and whether the approved discounts were being passed on to end customers. The excess discounts generated funds that were used to make improper payments funneled through Microsoft’s LSPs and other third parties. As a result of the improper payments, Microsoft obtained $13,780,733 in business. An example of the deals is below: a. NAV Select Plus Agreement 17. On February 10, 2014, NAV, Hungary’s National Tax and Customs Administration launched a public tender for Microsoft desktop licenses. MS Hungary employees discussed, and were aware of, NAV’s anticipated budget before the tender launched. In anticipation of the tender, in December 2013, MS Hungary employees asked Microsoft’s Business Desk for a “one time” 27.85% discount beyond the standard discount. As a justification for the discount, the MS Hungary employees cited, without support, competition with other bidders, end customer price sensitivity, and the possibility of winning related services contracts. The Business Desk approved the request as long as the purchase occurred before Microsoft’s March 31 third quarter end. 18. When the tender was unexpectedly cancelled, MS Hungary’s General Manager emailed the owner and General Manager at one of MS Hungary’s LSPs with respect to rescheduling the tender that “NAV’s license order is very important by the end of March” (the end of Microsoft’s quarter) and “in case you have influence, please push it!” The General Manager of the LSP replied by asking if the LSP could “get involved.” Two days later, on March 17, 2014, an MS Hungary employee asked MS Hungary’s General Manager to contact an official in Hungary’s Ministry of National Development for help re-launching the tender to meet Microsoft’s March 31 third quarter end. Three days later, on March 20, 2014, the MS Hungary employee confirmed in an email to MS Hungary’s General Manager that “a positive decision was made yesterday.” NAV re-launched the tender on March 25, 2014. 4 19. Ultimately, on April 25, 2014, NAV announced as the winner of the tender for Microsoft licenses the LSP that had been asked to use his influence to get the tender re-launched. However, MIOL sold the licenses to a different LSP who did not bid in the tender. The LSP who won the tender eventually resold the licenses to NAV, without passing on to NAV the full amount of the additional discount, for a total gross margin of approximately €1.06 million, a portion of which was used to fund improper payments to government officials to re-launch the tender. b. ORFK Select Plus Agreement 20. On September 1, 2014, ORFK, Hungary’s National Police, an agency under the Ministry of the Interior, launched a public tender for desktop licenses. Bids were due two weeks later, on September 15, 2014. MS Hungary knew ORFK’s budget and discussed it as early as February 2014, long before the tender launched. 21. In March 2014, MS Hungary employees requested and the Business Desk approved a discount of 28.3% above the standard discounted price. To justify the discount, MS Hungary employees cited, without support, the same justifications in the NAV deal: competition, end customer price sensitivity and the possibility of additional new business for related services. The justifications for the discount were false. In June 2014, the Business Desk approved a further discount, bringing the total discount to 31.53%. The Business Desk conditioned the discount on the deal closing before the end of Microsoft’s fiscal year on June 30. 22. On June 27, 2014 (months before the tender was launched and days before Microsoft’s fiscal year end) a Microsoft LSP purchased licenses from MIOL for the deal for approximately €2.2 million. On September 1, 2014, ORFK launched the tender for the Microsoft license purchase. A different third party, not approved as a Microsoft LSP (and not the entity that purchased the licenses from MIOL in June), won the tender and signed the agreement with ORFK. Microsoft’s records do not reflect why the third party was involved in the deal and what service if any they provided. However, the LSP resold the licenses to the third party who sold them to the end customer for a total gross margin of €1.56 million. The justifications provided to Microsoft’s Business desk to secure the additional discounts were false and the discounts sought by MS Hungary employees were not passed on to the end government customer. Instead, the additional margin was used to fund improper payments to win the business for Microsoft. Service Engagements 23. From 2014 through 2015, MS Hungary paid third party subcontractors to provide services in connection with MS Hungary consulting service engagements provided to Hungarian government end customers. However, for some subcontractors, Microsoft records do not reflect what services, if any, they provided and MS Hungary employees admitted that certain subcontractors falsely recorded work performed on various engagements. MS Hungary 5 inaccurately recorded the work provided as legitimate transactions in its books and records. Moreover, MS Hungary employees and subcontractors falsely recorded their purported work performed on various service engagements in Microsoft’s timekeeping system. For example: a. ORFK Between March 2014 and April 2015, MS Hungary entered into two separate agreements to provide services to ORFK. MS Hungary subcontracted work on both projects to third parties. With respect to two of the third parties, there is little evidence of what work they performed on the projects. For one of the third parties, what work might have been performed is reflected in timekeeping records that contain false entries, including for work claimed to have been performed prior to MS Hungary and ORFK entering into a contract, a direct violation of Microsoft’s policies. b. NAV In 2014, MS Hungary entered into two service agreements with NAV. One of the service engagements involved a subcontractor, specifically requested by NAV officials, that was a new vendor in Microsoft’s systems and for which Microsoft conducted no due diligence. An inflated margin was built into the contract and paid to the vendor, which MS Hungary employees tracked on a spreadsheet. Despite concerns raised by MS Hungary employees about the competence of the vendor, one employee stated that they could not replace the vendor because “[it] is not simply a partner; it is THE PARTNER” (emphasis in original). The other service engagement involved a different subcontractor for whom there is no evidence that any services were provided. c. OFI In 2014 and 2015, MS Hungary provided services to OFI, the Hungarian Office for Education. The engagement had four phases and generated approximately $3.5 million in revenue for MS Hungary. As part of the project, MS Hungary subcontracted with a third party entity to provide certain consulting services. The individual who supplied these consulting services was at the same time employed by OFI. Microsoft records do not reflect any due diligence conducted on the third party or the government employee. To further conceal the conduct, work performed by the vendor/government employee was entered into Microsoft’s timekeeping records under a false name, which MS Hungary employees never questioned. Saudi Arabia 24. Between 2012 through 2014, employees in Microsoft’s Saudi Arabian subsidiary diverted at least $440,000 of funds, intended to be used for marketing and developing business proposals with Microsoft’s partners, to a slush fund that was used to pay travel expenses for Saudi 6 government employees and for gifts, furniture, laptops, tablets and other equipment for government agencies. MS Saudi Arabia funded the slush fund through larger than usual discounts and payments to two of its vendors and two of its LSPs. The fund was maintained by two of Microsoft’s vendors, who disbursed it at the direction of MS Saudi Arabia employees. The vendors received a payment for serving as the conduit for purchasing the gifts and arranging the travel. While Microsoft records do not accurately reflect the total amount and use of the funds, approximately $270,000 was used to pay for travel by government customers and approximately $35,000 for gifts and other services for government customers. Additionally, approximately $130,000 was paid for commissions and service fees to the vendors for their roles. Thailand 25. Between January 2013 and April 2015, a MS Thailand employee along with an employee of a MS Thailand LSP provided more than $100,000 in gifts and travel to employees of non-government banking customers while MS Thailand was engaged in business with the end customers. 26. Specifically, an employee of a MS Thailand LSP established an account funded through discounts provided by Microsoft on transactions, ostensibly to pay for training MS Thailand end customers on Microsoft’s software. However, instead of using the money for training, the MS Thailand employee and the MS Thailand LSP employee used the proceeds to purchase technology equipment and pay for travel for employees of MS Thailand’s non- government end customers. As part of this scheme, the MS Thailand employee would direct the MS Thailand LSP employee to submit a false purchase order for “training” to one of MS Thailand’s training vendors. The vendors would submit an invoice in connection with the purchase order that would then be paid from the training account held at the LSP. As with Saudi Arabia, the vendors received a “commission” payment “fee” for providing the false purchase order. Turkey 27. In July 2014, Turkey’s Ministry of Culture issued a public tender for Microsoft licenses and related services. The tender was awarded to a system integrator that was not an authorized MS Turkey LSP. An MS Turkey employee did not disclose the role of the system integrator in the transaction, and instead directed an authorized LSP to work on the transaction with the system integrator. The MS Turkey employee also negotiated the payments terms between the system integrator and LSP. In connection with the deal, MS Turkey approved an additional 7% discount on the transaction beyond the standard discount. Microsoft’s records do not reflect what services, if any, the system integrator provided, and the authorized reseller informed Microsoft that it provided the services on the transaction. Moreover, there is no evidence the additional discount was passed on to the government customer. 7 Legal Standards and Violations 28. As a result of the conduct described above, Microsoft violated Section 13(b)(2)(A) of the Exchange Act, which requires issuers to make and keep books, records and accounts which, in reasonable detail, accurately and fairly reflect their transactions and dispositions of the assets of the issuer. 29. As a result of the conduct described above, Microsoft also violated Section 13(b)(2)(B) of the Exchange Act, which requires issuers to devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances that (i) transactions are executed in accordance with management’s general or specific authorization; (ii) transactions are recorded as necessary (I) to permit preparation of financial statements in conformity with generally accepted accounting principles or any other criteria applicable to such statements, and (II) to maintain accountability for assets; (iii) access to assets is permitted only in accordance with management’s general or specific authorization; and (iv) the recorded accountability for assets is compared with the existing assets at reasonable intervals and appropriate action taken with respect to any differences. 30. Under 21C(a) of the Exchange Act, the Commission may impose a cease-and-desist order upon any person who is violating, has violated, or is about to violate any provision of the Exchange Act or any regulation thereunder, and upon any other person that is, was, or would be a cause of the violation, due to an act or omission the person knew or should have known would contribute to such violation. Non-Prosecution Agreement 31. MS Hungary has entered into a three-year non-prosecution agreement with the United States Department of Justice that acknowledges responsibility for conduct relating to certain findings in the Order. Non-Imposition of a Civil Penalty 32. Microsoft acknowledges that the Commission is not imposing a civil penalty based upon the imposition of an $8,751,795 criminal penalty as part of MS Hungary’s resolution with the Department of Justice. Microsoft’s Remedial Efforts and Cooperation 33. In determining to accept the Offer, the Commission considered remedial acts undertaken by Respondent and cooperation afforded the Commission staff. Microsoft’s 8 remediation included enhancing its internal accounting controls and compliance programs, taking disciplinary action against four MS Hungary employees, terminating four Hungarian licensing partners, enacting new discount transparency and pass-through requirements, creating an expanded transaction monitoring initiative at the regional level, and developing and using data analytics to help identify high-risk transactions. Microsoft’s cooperation included timely sharing of facts developed during the course of an internal investigation and voluntarily producing and translating documents. IV. A. Accordingly, it is hereby ORDERED that: Pursuant to Section 21C of the Exchange Act, Respondent Microsoft cease and In view of the foregoing, the Commission deems it appropriate to impose the sanctions agreed to in Respondent Microsoft’s Offer. desist from committing or causing any violations and any future violations of Sections 13(b)(2)(A) and 13(b)(2)(B) of the Exchange Act. $13,780,733 and prejudgment interest of $2,784,417.92 to the Securities and Exchange Commission for transfer to the general fund of the United States Treasury, subject to Exchange Act Section 21F(g)(3). If timely payment is not made, additional interest shall accrue pursuant to SEC Rule of Practice 600. Payment must be made in one of the following ways: Respondent shall, within 10 days of the entry of this Order, pay disgorgement of B. (1) (2) (3) Respondent may transmit payment electronically to the Commission, which will provide detailed ACH transfer/Fedwire instructions upon request; Respondent may make direct payment from a bank account via Pay.gov through the SEC website at http://www.sec.gov/about/offices/ofm.htm; or Respondent may pay by certified check, bank cashier’s check, or United States postal money order, made payable to the Securities and Exchange Commission and hand-delivered or mailed to: Enterprise Services Center Accounts Receivable Branch HQ Bldg., Room 181, AMZ-341 6500 South MacArthur Boulevard Oklahoma City, OK 73169 9 Payments by check or money order must be accompanied by a cover letter identifying By the Commission. Microsoft as a Respondent in these proceedings, and the file number of these proceedings; a copy of the cover letter and check or money order must be sent to Charles E. Cain, FCPA Unit Chief, 100 F. Street, N.E., Securities and Exchange Commission, Washington, DC 20549. Vanessa A. Countryman Secretary 10